TrendAI (Trend Micro) Intelligence and Pakistan’s NCCIA Drive Major Breakthrough in Global Tycoon 2FA Cybercrime Investigation

TrendAI has reinforced its leadership in AI-powered cyber threat intelligence after its attribution research contributed to a major international law enforcement investigation that led to the arrest of two suspected operators linked to the notorious Tycoon 2FA phishing-as-a-service (PhaaS) platform.

The operation, announced by the Singapore Police Force (SPF), was carried out in close collaboration with Pakistan’s National Cyber Crime Investigation Agency (NCCIA) and INTERPOL. Authorities arrested two suspects in Punjab while conducting coordinated raids across Islamabad, Faisalabad, and Sialkot. The raids resulted in the seizure of computers, servers, mobile devices, and digital storage media believed to have been used in cybercriminal operations. Investigators also revealed that four additional suspects fled Pakistan before the raids and are now the subject of INTERPOL Red Notice requests.

According to TrendAI, the arrests represent the next phase of a long-running international effort against Tycoon 2FA. Earlier this year, TrendAI worked alongside Europol, Microsoft, and global cybersecurity partners to support the disruption of the platform’s core infrastructure, resulting in the seizure of more than 300 malicious domains.

The latest operation focused on identifying and apprehending individuals responsible for developing and operating the phishing infrastructure behind the Tycoon 2FA brand.

A key contribution from TrendAI was its advanced attribution intelligence, which was shared with Europol and helped strengthen the broader international investigation. The intelligence formed part of the evidence supporting law enforcement agencies as they traced the criminal network and coordinated actions across multiple jurisdictions.

Pakistan’s National Cyber Crime Investigation Agency (NCCIA) played a pivotal role in executing the domestic investigation. Beyond the arrests, the agency recovered significant digital evidence and initiated legal proceedings to confiscate real estate in Islamabad that investigators believe was purchased using proceeds generated through cybercrime.

Tycoon 2FA emerged in 2023 as one of the world’s most sophisticated phishing-as-a-service platforms. The service enabled cybercriminals to bypass multi-factor authentication (MFA) by using adversary-in-the-middle (AiTM) techniques to steal credentials and active user sessions. Since its emergence, the platform has been linked to more than 24,000 phishing domains and campaigns targeting Microsoft 365 and Google users across multiple continents.

TrendAI researchers have tracked the evolution of the platform since 2025, providing intelligence that has supported international law enforcement efforts to disrupt both its infrastructure and operational network.

The successful collaboration between TrendAI, NCCIA, Singapore Police Force, INTERPOL, and Europol demonstrates the growing importance of AI-powered threat intelligence and cross-border cooperation in combating sophisticated cybercrime. As cybercriminals increasingly operate without geographical boundaries, timely intelligence sharing between the private sector and law enforcement has become critical for identifying threat actors and bringing them to justice.

The latest arrests represent a significant milestone in the global fight against phishing-as-a-service operations and reinforce the value of sustained intelligence-led investigations. TrendAI reaffirmed its commitment to supporting governments, enterprises, and law enforcement agencies worldwide through advanced AI-driven threat intelligence designed to help identify, investigate, and disrupt emerging cyber threats before they can impact organizations and citizens.

The post TrendAI (Trend Micro) Intelligence and Pakistan’s NCCIA Drive Major Breakthrough in Global Tycoon 2FA Cybercrime Investigation appeared first on ProPakistani.